Snapshot 184976
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Trust Site Start your security review View & download sensitive information Overview Demandbase is the pipeline engine for AI GTM that transforms goals into coordinated action across marketing, sales and advertising. It continuously evaluates what is driving pipeline and helps B2B teams scale what works. Thousands of businesses use Demandbase to align their go-to-market motion, reduce wasted spend, and drive revenue outcomes, all from one secure, unified platform. Compliance ISO/IEC 27001 SOC 2 Documents REPORTSPENTEST REPORTS 2026 DOCUMENTSAgentbase AI FAQ PRIVACYCross-Border Data Transfers DATA SECURITYData Diligence FAQ SELF-ASSESSMENTSCAIQ SELF-ASSESSMENTSSIG Lite REPORTSSOC 2 Type 2 Report COMPLIANCESOC 2 COMPLIANCEISO/IEC 27001 REPORTSPentest Report 2025 REPORTSPentest Report 2024 Risk Profile Impact LevelModerate Critical DependenceNo Third Party DependenceYes View more Product Security Audit Logging Data Security Integrations View more Reports PENTEST REPORTS 2026 SOC 2 Type 2 Report Vulnerability Assessment Report View more Self-Assessments CAIQ SIG Lite Data Security Access Monitoring Data Backups Data Diligence FAQ View more App Security Responsible Disclosure Bot Detection Code Analysis View more Legal Subprocessors Data Processing Addendum Master Subscription Agreement View more Privacy Cookies Cross-Border Data Transfers Data Protection Officer View more Access Control Data Access Logging Password Security Infrastructure Amazon Web Services Anti-DDoS BC/DR View more Endpoint Security Disk Encryption DNS Filtering Endpoint Detection & Response View more Network Security Firewall IDS/IPS Security Information and Event Management Corporate Security Asset Management Practices Email Protection Employee Training View more Policies Acceptable Use Policy Access Control Policy Anti-Malicious Software Policy View more Security Grades Qualys SSL Labs demandbase.com, api.demandbase.com A+ Trust Site Updates Demandbase Statement on PHP2Shell Vulnerabilities (as of October 22, 2026) Vulnerabilities Demandbase is aware of the two critical remote code execution (RCE) vulnerabilities affecting PHP, collectively referred to as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619). These vulnerabilities may allow unauthenticated attackers to execute arbitrary code, access information from other requests, or cause denial-of-service conditions on systems running vulnerable PHP versions. The vulnerabilities were publicly disclosed on October 21, 2026, after details were released ahead of the planned disclosure timeline. PHP released emergency security updates the same day, including PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Exploitation attempts were reportedly observed as early as October 17, 2026. Following the disclosure, Demandbase conducted a comprehensive review of our environments and dependency stacks. Our review confirmed that PHP is not used in the production environments supporting Demandbase products and services. Demandbase marketing websites are separately hosted and do not provide access to the Demandbase platform or customer data. Based on the results of our investigation, Demandbase is not currently impacted by these vulnerabilities. We found no evidence that these vulnerabilities affected Demandbase services or exposed customer data. We will continue to monitor developments related to these vulnerabilities, maintain close engagement with our engineering and security teams, and update this page if new information emerges. For additional details, please refer to the PHP security release information: https://www.php.net/archive/2026.php Demandbase Statement on React Vulnerabilities (as of December 8, 2025) Vulnerabilities Demandbase is aware of the recently disclosed critical remote code execution (RCE) vulnerabilities affecting the React Server Components (RSC) “Flight” protocol (CVE-2025-55182) and certain frameworks, including Next.js (CVE-2025-66478). These vulnerabilities may allow unauthenticated attackers to execute arbitrary server-side JavaScript when vulnerable RSC payload handling is present. Following the disclosure, Demandbase conducted a comprehensive review of our environments and dependency stacks. This assessment identified a single component that referenced a vulnerable public image, which was immediately addressed and remediated. No other affected components or vulnerable package versions were identified in our production services. Based on the results of our investigation and the remediation performed, Demandbase is not currently impacted by these vulnerabilities. The vulnerable component was addressed before any exploitable conditions were present, and no Demandbase systems, infrastructure, or customer data were exposed. We will continue to monitor developments related to these vulnerabilities, maintain close engagement with our engineering and security teams, and update this page if new information emerges. For additional details, please refer to the NIST advisories: https://nvd.nist.gov/vuln/detail/CVE-2025-55182 Demandbase Statement on Salesforce Integration Incident (as of September 3rd, 2025) Incidents Demandbase has reviewed the broader reports regarding the Salesloft and Drift incident. After a thorough review of our systems and integrations in light of this new information, we can confirm the following: No OAuth Connection: Demandbase's integration with Drift does not use OAuth or maintain a connected Salesforce integration through Salesloft or Drift. Due Diligence: Our security and engineering teams conducted audits of our infrastructure using multiple security technologies and monitoring systems. These audits have not identified any impact to Demandbase systems, customer data, or our Salesforce environment. We will continue to closely monitor developments and will provide further updates if necessary. Demandbase Statement on SharePoint Exploit Activity (as of July 21, 2025) Vulnerabilities Demandbase is aware of a critical zero-day vulnerability affecting Microsoft SharePoint Server, which is reportedly being exploited in a widespread campaign. Demandbase initiated an internal investigation to determine if any Microsoft SharePoint Server instances are currently deployed in our environment. Using Demandbase's infrastructure discovery and configuration management tools, along with asset inventories and audit reports, the Demandbase Security team has confirmed that no Microsoft SharePoint Server instances are present in our environment. Based on this assessment, we have found no evidence of exposure to this vulnerability. We will continue to monitor this situation closely and will reassess our environment should new indicators of compromise or attack vectors emerge. If any updates become necessary, we will communicate them promptly. For more information, please refer to the advisories posted by NIST: CVE-2025-53771 Zero Day Vulnerability Vulnerabilities On August 9th, 2024, Demandbase received intelligence regarding a zero-day vulnerability affecting certain browsers, including Chrome, Firefox, and Safari. This vulnerability allows external websites to communicate with, and potentially exploit, software running locally on macOS and Linux systems. Upon learning of this issue, Demandbase conducted an internal investigation and found no affected endpoints. Demandbase uses an unaffected version of Chrome, along with recommended advisory controls. We will continue to closely monitor developments related to this vulnerability, and will provide updates if necessary.